Introduction

I was introduced to Networking Monitoring tools during Summer 2018 through CSOL- 570 Network Visualization and Vulnerabilities Detection course by Professor Michael K Hallman. CSOL- 570 was my second class of this Cyber Security curriculum. The main goal of this course was to get familiar with tools a cyber engineer can leverage to protect a given information system. The reference book was: McGuerty, J. (2018). Network Field Survival Guide: The Way of the Packet. ISBN: 978-0972894104

 

Understanding Network Visualization and Vulnerabilities Detection were proved invaluable. On the professional level, the learning process involved the need to build a lab and perform a trade study of tools for Network Visualization and Vulnerabilities Detection. This approach enabled me to better understand the need not only for the correct Network Visualization and Vulnerabilities Detection tools but the reason for the overall Cyber Security strategy.

Network Visualization is a network management application tool meant primary, among other tasks, to monitor information technology infrastructures such as network devices, servers, virtual machines, and cloud services and to report on their status.  A network management tool is not optimized to scan a network to detect vulnerabilities; instead, it is there to help a network administrator to know the status of his network overall and pinpoint issues thanks to the application's capabilities. OpenNMS is an example of a Network Visualization application.  Network Vulnerabilities detection, on the other hand, is an application deployed in network infrastructure to scan for vulnerabilities usually against a known database such as CVE or NVT and to report upon them.  OpenVAS is an example of a Network Vulnerabilities Detection application. Some tools, however, can combine several features by using extensions to expand their traditional functions. It is not uncommon to find products supporting both visualization and vulnerabilities scanning and more features.

Having a network equipped with network visualization and vulnerabilities scanning tools is a paramount prerequisite to the success of the overall Cyber Security strategy. Network visualization, as in a ship, will act as a compass to help determine the status of the network while the vulnerability capability will help the organization to be proactive in detecting vulnerabilities earlier so fix can be provided on time. Most of the network visualization tools provide logging capabilities that are important to cyber defenders. In lack of this, attackers can hide their malicious software, location, and activities on the victim machines. And logging also can serve as a record of evidence of a successful attack. On the vulnerability side, cyber defenders are facing a constant stream of new information which may require some actions from them. These include but not limited to patches, threat bulletins, software updates, and so forth. If there is no process or tool to address these issues, the chances are that attackers will take advantage of this security gap and will expose the network infrastructure to great risks.

It is a big mistake to wait to address an issue until some cyber incidents that could have been prevented strike. A Cyber Security professional in the course of his professional career should be at the forefront of this simple security prevention mechanism especially when given the opportunity of implementing a cybersecurity plan. He should ethically plan in putting in place a fair process to select the more appropriate products based on the company's realities. The ethical notion should encompass the concern of selecting products with the right price and the right features set to reach a stated goal. Furthermore, based on the Center for Internet Security, CIS (n.d.), Network Visualization, and Vulnerability Detection are part of the top 20 critical controls for effective cyber defense. The California Attorney General (2016) has made the 20 top controls as minimum requirements for companies doing business in California. According to Harris, Kamala D., California Attorney General, "The 20 controls in the Center for Internet Security’s Critical Security Controls define a  minimum level of information security that all organizations that collect or maintain personal information should meet. The failure to implement all the Controls that apply to an organization’s environment constitutes a lack of reasonable security. " pg 30.

In this document are a trade study where the best tool for Network Visualization and Network Vulnerability was to be chosen and some understanding of the other aspect of other Cyber Security modules for their professional and ethical application.

Common terms

CVE: Common Vulnerabilities and Exposures
The Common Vulnerabilities and Exposures system provides a reference-method for publicly known information-security vulnerabilities and exposures. The National Cybersecurity FFRDC, owned by The MITRE Corporation, maintains the system, with funding from the National Cyber Security Division of the United States Department of Homeland Security

NVT: Network Vulnerability Tests.

NVT is more OpenVAS proprietary. NVTs are test routines that check for the presence of a vulnerability on a target system. OpenVAS coordinates the execution of many of such tests to many target systems and collects the results.

Trade Study Description

 

Common knowledge of both trade studies

During the seven weeks of this course, I have been asked in two of the seven assignments not only to first select a network visualization tool, second, a network vulnerability assessment tool but also to come up with a logical mechanism of selecting them. Here is a summary of the process behind that exercise with some corrections, as I have learned more in the process.

Scoring Mechanism and Formulae

The scoring system I adopted is the one that gives some marks based on what the software provides. That score is from 0 to 10 for each criterion with 0 being the lowest or no support provided while 10 means full support. Let take an example of the criterion that is related to cost. Providers of the tools choose either to offer it completely free, and this is the case for OpenVAS. In this case, the score on these criteria will be 10. On the other hand, Nessus Home is a limited free version to 16 hosts only, and because of this limitation trick, the score for the cost is much lower. Each criterion has a defined weight based on what I think is important as a goal for my limited LAB environment. Weight can change if my lab expands to include more nodes.

To perform a scientific selection, I defined some parameters as it can be seen in Table A. These parameters are common for both studies and were applied during the final selection. Each parameter has a description of what it does. The raw score is based on a range of values from 0 to 10 for each criterion I defined in this study. 0 is the lowest value a tool can receive, while 10 is the highest. 

 

For example, OpenVAS scores 10 as its raw score value for its support for Web management while it receives only 8 for documentation. The Weighted Score Value, on the other hand, represents the weight or how much a given criterion worth compared to the rest. The total value for all Weighted Score Value must be 100%. The combination of the Raw Score (RS), the Weighted Score Value (WSV), and the maximum score (MS) allowed me to calculate precisely the Weighted Score for each Tool per criterion.

Formulae to calculate the Criteria Weighted Factor, CWF, for each value of the Weighted Score Value is:
CWF = WSV /MS

Formulae to calculate the Weighted Score (WS) per given criterion per tool is: WS = RS x CWF

​

​